Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the /api/v1/openai-assistants-file
endpoint in index.ts
is vulnerable to arbitrary file read due to lack of sanitization of the fileName
body parameter. No known patches for this issue are available.
{ "nvd_published_at": "2024-07-01T16:15:04Z", "cwe_ids": [ "CWE-74" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-08-05T21:29:27Z" }